Use cases

Same Signal, Different Cause: The Forensic Nightmare at the Heart of Natech Risk

A malicious actor can easily weaponize every vulnerability that a hurricane exposes. And the tools built to stop them (firewalls, intrusion detection systems, access controls) are structurally incapable of seeing it happen.

Ariane

May 21, 2026 — 5 min read

Photo by Jake Walker / Unsplash

This is Part 2 of a three-part series on Natech risk and cyber safety in critical infrastructure. Part 1 explained how natural disasters corrupt sensor data and trigger cascading failures. Part 2 examines how adversaries exploit that corruption. Part 3 lays out the technical and governance methods to close the gap.

Two feedback loops that turn incidents into cascades

Before examining how adversaries exploit disaster conditions, it's essential to understand the two feedback mechanisms that amplify the Natech cyber physical failure chain (physical damage, sensor corruption, confident AI acting on invalid data, system-accelerated crisis). These loops worsen Natech events and create conditions attackers exploit.

The Physical → Cyber Loop

When nature damages physical infrastructure, it breaks pipes, floods basements, and blinds the digital layer. A power outage caused by storm damage can take down firewalls, intrusion detection systems, and monitoring dashboards. Communication links fail. Backup power prioritizes process control over security tooling. The result is a security vacuum at the precise moment visibility matters most. The plant's digital immune system goes dark while the physical crisis is accelerating.

This loop is what transforms a manageable weather event into an uncontrolled cascade. Safety systems relying on digital oversight lose power, connectivity, or sensor feeds needed to function. The plant is flying blind, and nobody in the control room can see it.

The Cyber → Physical Loop

The second loop runs in the opposite direction and it's the one that opens the door to adversaries. During a natural disaster, every resource shifts to physical response. Operators are managing evacuations, isolating damaged equipment, coordinating emergency crews. Cybersecurity monitoring falls to the bottom of the priority list.

Malicious actors can exploit this chaos deliberately. A heatwave provides cover for a cooling system override. A flood creates plausible explanations for sensor anomalies that would normally trigger investigation. The natural disaster becomes both the weapon and the alibi, amplifying the physical impact of an intrusion while simultaneously masking its digital signature.

These two loops feed each other. Physical damage blinds the digital layer. The blinded digital layer creates openings for adversaries. Adversarial action worsens the physical damage. The cycle accelerates.

The fundamental blindness

Traditional industrial cybersecurity was built on IT security principles. Firewalls verify credentials. Encryption protects channels. Intrusion detection systems watch for anomalous network patterns. If a signal arrives from an authenticated device via a trusted protocol, the system clears it.

During a Natech event, this paradigm breaks completely. The is no breach, no malware or no u unauthorized access. A legitimate, authenticated sensor, even if it has been physically damaged by floodwater, shaken loose by seismic activity, or degraded by extreme heat, transmits data that looks perfectly normal but is physically impossible.

Better firewalls cannot close this gap. It is an architectural blind spot. Cybersecurity monitors the digital domain. Safety engineering monitors the physical domain. Natech risks live in the space between them. And that space is exactly where adversaries operate.

Three compounding pathways

The blind spot, widened by both feedback loops, creates three distinct pathways that adversaries can exploit during and after natural disasters.

Pathway 1: Spoofing under the cover of disaster

A natural disaster provides the perfect cover story for manipulated data. Consider a coastal refinery during a Category 4 hurricane. Storm surge has flooded the tank farm. The Physical → Cyber loop has already degraded monitoring, backup power is prioritizing process control, and the security operations centre has lost half its feeds. Operators are managing an emergency from the control room, relying entirely on their screens.

An attacker injects false level readings into the tank monitoring system. The data shows tanks at safe levels. In reality, floodwater has displaced product and containment is failing. The spoofed data is indistinguishable from the kind of noise operators expect during extreme weather.

The disaster provides plausibility. Every anomaly has a ready-made explanation. Every false reading has a natural alibi.

Pathway 2: recovery exploitation

The hours and days following a natural disaster are both the most dangerous period for cyber intrusion and the least defended. The Cyber → Physical loop is in full effect as every resource is focused on getting the plant back online.

Technicians open remote access ports to diagnose equipment from offsite. Security protocols are temporarily bypassed to accelerate restoration. Temporary permissions become semi-permanent. Vendor laptops are plugged directly into OT networks to reconfigure damaged controllers.

Every one of these actions is rational in context. Every one of them also creates an attack surface that didn't exist before the disaster. Malicious actors don't need to breach the perimeter since the recovery team opens it for them. And the urgency of the situation means nobody is watching the access logs while they're pumping water out of a substation.

Pathway 3: indistinguishable failures

This is the most insidious pathway. It doesn't exploit the disaster in real time or the recovery afterward. It exploits the uncertainty that follows.

After a combined natural-disaster-and-cyber event, forensic teams struggle to distinguish whether the environmental damage caused a sensor failure, or whether an attacker exploited the damage as cover. The digital evidence is identical. A pressure transmitter that drifted because floodwater corroded its housing produces the same false signal as one that was deliberately spoofed. The logs show the same authenticated data from the same trusted device.

This ambiguity has consequences far beyond the incident itself. Insurance claims stall. Regulatory investigations reach inconclusive findings. Root-cause analyses produce equivocal results. And the organization cannot learn from the event because it cannot determine what actually happened.

Why stronger firewalls cannot close this gap

These three pathways share a common characteristic, none of them involve unauthorized network activity. The spoofed data in Pathway 1 comes from authenticated devices. The access in Pathway 2 is granted by authorized personnel. The forensic ambiguity in Pathway 3 exists precisely because the malicious activity is indistinguishable from legitimate failure.

A physics-based detection layer is the only way to address all three pathways as it doesn't need to know whether the false data came from a hurricane, a hacker, or a corroded wire. It only needs to know that the reported state violates what the physical world should be doing.

The same physical laws that make sensor corruption dangerous also make it detectable (if you know where to look).

In Part 3 — Physics Doesn't Lie: Engineering the Last Line of Defense Against Threats We Can't Tell Apart, we lay out the four technical methods, the governance framework that close the gap, and revisit Winter Storm Uri to show what could have been different. The physics gap is real. But so are the tools to close it.